Moderate
Guidance
Published
European Union · Sep 23, 2026
EU Commission hosts fifth roundtable on Digital Services Act implementation
On 23 September 2026 the European Commission held an online roundtable with about 60 civil society organisations and researchers to discuss the implementation of the Digital Services Act. The discussion focused on systemic risks…
European Commission · Digital Services Act
Moderate
Fine
Decided
Spain · Sep 22, 2026 · effective Feb 1, 2023 · deadline Feb 1, 2024
Spanish DPA fines Securitas Direct €100,000 for charging phone line for data subject rights
The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The…
Spanish Data Protection Agency (AEPD) · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 18, 2026
EFF urges lawmakers to base AI cybersecurity rules on established best practices
The EFF recommends that any new AI cybersecurity legislation focus on proven security measures such as sandboxing, monitoring, and logging to mitigate risks demonstrated by recent AI lab incidents. It calls for minimum safety requirements…
Moderate
Proposed regulation
Announced
France · Sep 17, 2026
CNIL plenary agenda includes draft decrees on prison camera use, Apple ATT, and data collection in real‑estate rentals
The CNIL plenary session of 17 September 2026 will discuss a draft decree on the use of on‑board cameras by prison surveillance staff, a draft decree amending the 2019 decree that implements the French data protection law, and a…
Commission nationale de l'informatique et des libertés (CNIL) · décret n° 2019-536 du 29 mai 2019
High
Enforcement
Settled
United States (federal) · Sep 17, 2026
FleetCor to Pay $100M to Settle FTC Administrative Action Over Unauthorized Fuel Card Fees
The Federal Trade Commission alleged that FleetCor, now operating as Corpay, charged small‑business customers hidden fees and misrepresented savings from its fuel cards. The company agreed to pay $100 million to resolve the FTC…
Federal Trade Commission · FTC Act Section 5
Moderate
FRAMEWORK UPDATE
Published
European Union · Sep 17, 2026 · effective Aug 2, 2026
EU AI Board discusses AI Act implementation and publishes Action Plan on cybersecurity and AI
On 17 September 2026 the EU AI Board met under the Irish Presidency to review priorities for EU AI policy and AI Act enforcement. The meeting included an update on the Commission’s Action Plan on cybersecurity and AI and on transparency…
European Commission · EU AI Act
Low
Guidance
Announced
United States (federal) · Sep 16, 2026
EPIC report finds companies hinder personal data access under state privacy laws
The Electronic Privacy Information Center reports that many large firms make it difficult for consumers to obtain their personal data, despite state privacy statutes. EPIC notes that small fines and warning letters often have limited…
High
Fine
Decided
France · Sep 11, 2026 · effective Jul 21, 2026
CNIL fines French IT firm EXTIA €300,000 for failing to honor data erasure requests
In 2024 EXTIA received 265 requests for erasure, many of which were not processed or not communicated to the requesters. The CNIL audit found breaches of Articles 12 and 17 GDPR regarding transparency and the right to erasure. The CNIL…
CNIL · General Data Protection Regulation
Low
Enforcement
Announced
Germany · Sep 10, 2026
noyb to file injunction against SCHUFA over shadow database
noyb sent a cease-and-desist letter to SCHUFA demanding the removal of its shadow database. SCHUFA's deadline to comply has expired and the agency has rejected the allegations. noyb announced it will now file an injunction and invites…
Moderate
Proposed regulation
Proposed
European Union · Sep 10, 2026
EU Commission proposes Article 88b for automated privacy signals in Digital Omnibus
The European Commission, as part of the Digital Omnibus package, proposed legally binding automated privacy signals under Article 88b of the GDPR to replace cookie banners. The proposal would let users set their privacy preferences once…
European Commission · California Delete Act
Low
Enforcement
Announced
European Union · Sep 4, 2026 · effective Aug 31, 2026
EU Commission designates ChatGPT as VLOSE and Reddit, Roblox as VLOPs under DSA
On August 31, 2026, the European Commission announced that it had designated ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit and Roblox as Very Large Online Platforms (VLOPs) under the Digital Services Act. The designations…
European Commission · Digital Services Act
Moderate
Guidance
Published
United States (federal) · Aug 31, 2026
EFF guide on doxxing incident response and digital footprint protection
The Electronic Frontier Foundation published a guide outlining steps for individuals and groups to respond to doxxing attacks. It covers incident logging, team role assignment, monitoring hate forums, setting up alerts, hardening accounts…
California Delete Act
Low
Proposed regulation
Proposed
BR · Aug 28, 2026
EFF and allies recommend new privacy safeguards to protect Brazil's electoral integrity
The Electronic Frontier Foundation, Access Now and Data Privacy Brasil issued recommendations urging stronger personal data protection in Brazil's elections. They call for prohibiting processing of sensitive political data, requiring…
LGPD
Moderate
Settlement
Settled
Connecticut · Aug 27, 2026
Connecticut AG settles with TaxAct over taxpayer data disclosures via tracking tech
On August 19, 2026, Connecticut Attorney General William Tong announced a $275,000 settlement with TaxAct for improperly disclosing taxpayer information to advertising partners through third‑party tracking technologies. The settlement…
Connecticut Attorney General
Low
Enforcement
Announced
Germany · Aug 26, 2026 · effective Aug 26, 2026
noyb sends cease‑and‑desist letter to SCHUFA over alleged ‘shadow database’ GDPR violations
In July 2026, the NGO noyb issued a cease‑and‑desist letter to German credit agency SCHUFA demanding it stop storing data beyond retention periods and provide full historical data under Article 15 GDPR. The organization warned it will seek…
EDPB · General Data Protection Regulation
Moderate
New law
Signed
Colorado · Aug 17, 2026 · effective Jan 1, 2027
Colorado governor signs SB 26-189, revising AI Act to regulate ADMT in employment
On May 14, 2026, Colorado Governor signed SB 26-189, repealing and replacing the 2024 Artificial Intelligence Act. The new law, effective January 1, 2027, targets automated decision‑making technology (ADMT) that materially influences…
DE DOJ · Delaware Personal Data Privacy Act
Low
Guidance
Published
United States (federal) · Aug 11, 2026
EFF states all images are human-generated, with rare AI exceptions
EFF announced that its blog and merchandise images are created by human designers, not AI image generators, except for rare cases that are explicitly credited. The organization added a credit label "Image created by EFF" to banner images…
Creative Commons Attribution (CC‑By) license
Moderate
Guidance
Announced
United States (federal) · Aug 5, 2026
Future of Privacy Forum releases updated AI risk assessment framework and best practices for hiring
Future of Privacy Forum and leading HR software firms released Updated Best Practices for AI and Workplace Assessment Technologies, addressing generative and agentic AI in employment. The guidance outlines a risk assessment framework and…
EU AI Office · EU AI Act
Moderate
Proposed bill
Introduced
United States (federal) · Aug 5, 2026
Senator Mark Kelly introduces Senior Chatbot Protection Act
Future of Privacy Forum notes the bipartisan Senior Chatbot Protection Act was introduced to establish baseline consumer protections and transparency for AI chatbots used by older adults. The statement welcomes the effort to create clear…
Delaware Personal Data Privacy Act
